Vasion Print (PrinterLogic) Virtual Appliance vulnerabilities

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script. An unauthenticated attacker can exploit the lack of validation of the printer host address to send requests to internal services.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in PrinterInstallerClient components. The software creates files as NT AUTHORITY\SYSTEM inside a directory controlled by the local user (C:\Users\%USER%\AppData\Local\Temp\). An attacker who can place symbolic links or influence filenames can cause the service to write to arbitrary filesystem locations as SYSTEM, leading to local privilege escalation.

A vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) allows arbitrary file write via response file handling. The service writes response data into files under /opt/PrinterInstallerClient/tmp/responses/ reusing the requested filename, follows symbolic links, and writes as the service user (typically root), allowing a local unprivileged user to overwrite or create arbitrary files as root.

A vulnerability in the local logging mechanism of Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) stores authentication session tokens (PHPSESSID, XSRF-TOKEN, laravel_session) in cleartext within world-readable log files. Any local user with access to the machine can extract these tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials.